Description
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation leading to full application takeover
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Valid Session component of Oracle Applications Platform Engineering permits a low‑privileged local user to compromise the application. The attacker can bypass normal session controls, alter or access sensitive data, and ultimately gain full control over the application, resulting in complete loss of confidentiality, integrity, and availability.

Affected Systems

Oracle’s Applications Platform Engineering part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. Any installation of those versions running in an environment where local user accounts exist is at risk.

Risk and Exploitability

The CVSS 3.1 base score of 7.8 indicates a high‑risk vulnerability. EPSS is less than 1 % and the issue is not listed in CISA’s KEV catalog. Exploitation requires local logon to the infrastructure hosting Applications Platform Engineering; no remote interaction or user interface is necessary, making the attack path straightforward for an attacker who can access the host.

Generated by OpenCVE AI on October 28, 2026 at 17:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security update that addresses CVE‑2026‑87356, ensuring the applied patch contains the fix.
  • Restrict local accounts on the host running Applications Platform Engineering to the minimum privileges required for their function and enforce least privilege policies.
  • Enable detailed auditing and logging for the Valid Session component, regularly review logs for unauthorized session creation or manipulation.

Generated by OpenCVE AI on October 28, 2026 at 17:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Applications Platform Engineering Valid Session Component

Wed, 28 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Valid Session in Oracle Applications Platform Engineering
Weaknesses CWE-640

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Valid Session in Oracle Applications Platform Engineering
Weaknesses CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Platform Engineering
CPEs cpe:2.3:a:oracle:applications_platform_engineering:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Platform Engineering
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Platform Engineering
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-31T03:56:47.412Z

Reserved: 2026-09-08T21:49:12.413Z

Link: CVE-2026-87356

cve-icon Vulnrichment

Updated: 2026-10-28T13:40:44.914Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:13.427

Modified: 2026-10-31T04:18:22.087

Link: CVE-2026-87356

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T17:45:02Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor